CVE-2026-83461

CVE-2026-83461 is a vulnerability in the MWA Terminal Server component of the Oracle Mobile Application Server within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is remotely exploitable by an unauthenticated attacker who has network access to the service over TCP, requiring no privileges or user interaction. A successful attack lets the attacker compromise the Mobile Application Server, gaining unauthorized access to critical data or to all data the server can reach, and the ability to cause a partial denial of service. The flaw carries a CVSS 3.1 base score of 8.2 (high), driven by high confidentiality impact and low availability impact, with no integrity impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known, so no active exploitation has been observed.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw on any E-Business Suite 12.2.3-12.2.15 environment running the MWA Terminal Server. Restrict TCP access to the MWA service to trusted warehouse/mobile-device networks via firewall rules, and do not expose it to the internet. Review MWA server logs for unexplained unauthenticated connections or data access and performance degradation consistent with attempted exploitation.